Cisco 350XG series Instruction Manual

Cisco 350XG and 550XG Series 10G Stackable
Managed Switches
ADMINISTRATION
GUIDE

Cisco 350XG and 550XG Series 10G Stackable Managed Switches Administration Guide 1
Contents
Chapter 1: Getting Started 10
Starting the Web-based Configuration Utility 10
Out-Of-Band Port 14
Basic or Advanced Display Mode 15
Quick Start Device Configuration 15
Interface Naming Conventions 16
Window Navigation 17
Chapter 2: Cisco 350XG & 550XG Series 10G Stackable Managed Switches
Dashboard 21
Overview 21
Grid Management 22
System Health 22
Resource Utilization 23
Identification 24
Latest Logs 25
Suspended Interfaces 25
Stack Topology 26
Chapter 3: Configuration Wizards 27
Getting Started Wizard 27
VLAN Configuration Wizard 29
Chapter 4: Status and Statistics 31
System Summary 32
CPU Utilization 33
Interfaces 34
Etherlike 35
GVRP 36
802.1X EAP 37

Cisco 350XG and 550XG Series 10G Stackable Managed Switches Administration Guide 2
Contents
ACL 39
TCAM Utilization 39
Health 41
Port and VLAN Mirroring 43
Diagnostics 45
RMON 48
View Logs 56
Chapter 5: Administration 58
Device Models 58
System Settings 59
Console Settings (Autobaud Rate Support) 60
User Accounts 61
Idle Session Timeout 62
System Log 63
Reboot 67
Routing Resources 68
Ping 72
Traceroute 74
Chapter 6: Administration: File Management 75
System Files 75
Firmware Operations 77
File Operations 81
File Directory 89
DHCP Auto Configuration/Image Update 90
Chapter 7: Administration: Stack Management 100
Overview 100
Types of Units in Stack 102

Cisco 350XG and 550XG Series 10G Stackable Managed Switches Administration Guide 3
Contents
Stack Topology 103
Unit ID Assignment 104
Master Selection Process 105
Stack Changes 105
Unit Failure in Stack 106
Software Auto Synchronization in Stack 108
Stack Ports 109
Stack Management 111
Chapter 8: Administration: Time Settings 113
System Time Configuration 114
SNTP Modes 115
System Time 116
SNTP Unicast 118
SNTP Multicast/Anycast 121
SNTP Authentication 122
Time Range 123
Recurring Time Range 124
Chapter 9: Administration: Discovery 126
Bonjour 126
LLDP and CDP 127
Configuring LLDP 129
Configuring CDP 149
CDP Statistics 157
Chapter 10: Port Management 159
Workflow 159
Port Settings 160
Error Recovery Settings 164

Cisco 350XG and 550XG Series 10G Stackable Managed Switches Administration Guide 4
Contents
Loopback Detection Settings 165
Link Aggregation 167
UDLD 175
Green Ethernet 183
Chapter 11: Smartport 191
Overview 192
How the Smartport Feature Works 197
Auto Smartport 198
Error Handling 202
Default Configuration 202
Relationships with Other Features 202
Common Smartport Tasks 202
Configuring Smartport Using The Web-based Interface 205
Built-in Smartport Macros 210
Chapter 12: VLAN Management 221
Overview 221
Regular VLANs 228
Private VLAN Settings 236
GVRP Settings 237
VLAN Groups 238
Voice VLAN 242
Access Port Multicast TV VLAN 256
Customer Port Multicast TV VLAN 259
Chapter 13: Spanning Tree 262
STP Flavors 262
STP Status and Global Settings 263
STP Interface Settings 265

Cisco 350XG and 550XG Series 10G Stackable Managed Switches Administration Guide 5
Contents
RSTP Interface Settings 268
Multiple Spanning Tree Overview 270
MSTP Properties 271
VLANs to a MSTP Instance 272
MSTP Instance Settings 273
MSTP Interface Settings 274
Chapter 14: Managing MAC Address Tables 277
Static Addresses 278
Dynamic Addresses 279
Reserved MAC Addresses 280
Chapter 15: Multicast 281
Multicast Forwarding 281
Multicast Properties 287
MAC Group Address 287
IP Multicast Group Addresses 289
IPv4 Multicast Configuration 291
IPv6 Multicast Configuration 297
IGMP/MLD Snooping IP Multicast Group 303
Multicast Router Ports 304
Forward All 305
Unregistered Multicast 306
Chapter 16: IP Configuration 307
Overview 307
IPv4 Management and Interfaces 309
IPv6 Management and Interfaces 337
Domain Name System 360

Cisco 350XG and 550XG Series 10G Stackable Managed Switches Administration Guide 6
Contents
Chapter 17: IP Configuration: RIPv2 366
Overview 366
How Rip Operates on the Device 367
Configuring RIP 370
Access Lists 375
Chapter 18: IP Configuration: VRRP 378
Overview 378
VRRP Topology 379
Configurable Elements of VRRP 380
Configuring VRRP 384
Chapter 19: Security 388
Configuring TACACS+ 389
Configuring RADIUS 394
Password Strength 398
Key Management 400
Management Access Method 403
Management Access Authentication 408
SSL Server 409
TCP/UDP Services 412
Storm Control 413
Port Security 416
IP Source Guard 419
ARP Inspection 423
Denial of Service Prevention 428
Chapter 20: Security: 802.1X Authentication 439
Overview 439
Properties 453

Cisco 350XG and 550XG Series 10G Stackable Managed Switches Administration Guide 7
Contents
Port Authentication 455
Host and Session Authentication 458
Authenticated Hosts 459
Locked Clients 460
Web Authentication Customization 460
Chapter 21: Security: Secure Sensitive Data Management 464
Introduction 464
SSD Management 465
SSD Rules 465
SSD Properties 471
Configuration Files 473
SSD Management Channels 478
Menu CLI and Password Recovery 479
Configuring SSD 479
Chapter 22: Security: SSH Server 483
Overview 483
Common Tasks 484
SSH User Authentication 485
SSH Server Authentication 487
Chapter 23: Security: SSH Client 488
Overview 488
SSH User Authentication 494
SSH Server Authentication 496
Change User Password on the SSH Server 497
Chapter 24: Security: IPv6 First Hop Security 499
IPv6 First Hop Security Overview 500

Cisco 350XG and 550XG Series 10G Stackable Managed Switches Administration Guide 8
Contents
Router Advertisement Guard 502
Neighbor Discovery Inspection 503
DHCPv6 Guard 504
Neighbor Binding Integrity 504
IPv6 Source Guard 507
Attack Protection 508
Policies, Global Parameters and System Defaults 510
Common Tasks 511
Default Settings and Configuration 514
Before You Start 515
Configuring IPv6 First Hop Security through Web GUI 515
Chapter 25: Access Control 535
Overview 535
MAC-Based ACLs Creation 539
IPv4-based ACL Creation 541
IPv6-Based ACL Creation 546
ACL Binding 550
Chapter 26: Quality of Service 553
QoS Features and Components 554
General 557
QoS Basic Mode 569
QoS Advanced Mode 572
Managing QoS Statistics 583
Chapter 27: SNMP 587
Overview 587
SNMP Engine ID 591
Views 593

Cisco 350XG and 550XG Series 10G Stackable Managed Switches Administration Guide 9
Contents
Groups 594
Users 596
Communities 598
Trap Settings 600
Notification Recipients 600
Notification Filter 605

1
Cisco 350XG & 550XG Series 10G Stackable Managed Switches 10
Getting Started
This section provides an introduction to the web-based configuration utility, and
covers the following topics:
•Starting the Web-based Configuration Utility
•Out-Of-Band Port
•Basic or Advanced Display Mode
•Quick Start Device Configuration
•Interface Naming Conventions
•Window Navigation
Starting the Web-based Configuration Utility
This section describes how to navigate the web-based switch configuration utility.
If you are using a pop-up blocker, make sure it is disabled.
Browser Restrictions
If you are using IPv6 interfaces on your management station, use the IPv6 global
address and not the IPv6 link local address to access the device from your
browser.

Getting Started
Starting the Web-based Configuration Utility
Cisco 350XG & 550XG Series 10G Stackable Managed Switches 11
1
Launching the Configuration Utility
To open the web-based configuration utility:
STEP 1 Open a Web browser.
STEP 2 Enter the IP address of the device you are configuring in the address bar on the
browser, and then press Enter.
NOTE When the device is using the factory default IP address of 192.168.1.254, its system
LED flashes continuously. When the device is using a DHCP-assigned IP address or
an administrator-configured static IP address, the system LED is on solid.
By factory default, the device has DHCP enabled on all ports, including the Out of
Band (OOB) port, and the default IP address 192.168.1.254 is configured to the
OOB port of the device. To access the device with the IP address configured on
the OOB port, make sure the OOB port is connected to your network or PC.
Logging In
The default username/password is cisco/cisco. The first time that you log in with
the default username and password, you are required to enter a new password.
NOTE If you have not previously selected a language for the GUI, the language of the Login
page is determined by the language(s) requested by your browser and the
languages configured on your device. If your browser requests Chinese, for
example, and Chinese has been loaded into your device, the Login page is
automatically displayed in Chinese. If Chinese has not been loaded into your
device, the Login page appears in English.
The languages loaded into the device have a language and country code (en-US,
en-GB and so on). For the Login page to be automatically displayed in a particular
language, based on the browser request, both the language and country code of
the browser request must match those of the language loaded on the device. If the
browser request contains only the language code without a country code (for
example: fr). The first embedded language with a matching language code is
taken (without matching the country code, for example: fr_CA).

Getting Started
Starting the Web-based Configuration Utility
1
Cisco 350XG & 550XG Series 10G Stackable Managed Switches 12
To log in to the device configuration utility:
STEP 1 Enter the username/password. The password can contain up to 64 ASCII
characters. Password-complexity rules are described in Password Strength.
STEP 2 If you are not using English, select the desired language from the Language drop-
down menu. To add a new language to the device or update a current one, see the
description of the Language Menu described in Application Header.
STEP 3 If this is the first time that you logged on with the default user ID (cisco) and the
default password (cisco) or your password has expired, the Change Password
Page appears. See Password Expiration for additional information.
STEP 4 Choose whether to select Password Complexity Settings in the Password
Strength page.
STEP 5 Enter the new password and click Apply.
When the login attempt is successful, the Getting Started page appears.
If you entered an incorrect username or password, an error message appears and
the Login page remains displayed on the window.
Select Don't show this page on startup to prevent the Getting Started page from
being displayed each time that you log on to the system. If you select this option,
the System Summary page is opened instead of the Getting Started page.
HTTP/HTTPS
You can either open an HTTP session (not secured) by clicking Log In, or you can
open an HTTPS (secured) session, by clicking Secure Browsing (HTTPS). You are
asked to approve the logon with a default RSA key, and an HTTPS session is
opened.
NOTE There is no need to input the username/password prior to clicking the Secure
Browsing (HTTPS) button.
For information on how to configure HTTPS, see SSL Server.

Getting Started
Starting the Web-based Configuration Utility
Cisco 350XG & 550XG Series 10G Stackable Managed Switches 13
1
Password Expiration
The New Password page is displayed in the following cases:
•The first time that you access the device with the default username cisco
and password cisco. This page forces you to replace the factory default
password.
•When the password expires, this page forces you to select a new
password.
Logging Out
By default, the application logs out after ten minutes of inactivity. You can change
this default value as described in the Defining Idle Session Timeout section.
!
CAUTION Unless the Running Configuration is copied to the Startup Configuration, rebooting
the device removes all changes made since the last time the file was saved. Save
the Running Configuration to the Startup Configuration before logging off to
preserve any changes you made during this session.
A flashing red X icon to the left of the Save application link indicates that Running
Configuration changes have not yet been saved to the Startup Configuration file.
The flashing can be disabled by clicking on the Disable Save Icon Blinking button
on the Copy/Save Configuration page
When the device auto-discovers a connected device, such as an IP phone (see
What is a Smartport), and it configures the port appropriately for the device.
These configuration commands are written to the Running Configuration file. This
causes the Save icon to begin blinking when the you log on, even though you did
not make any configuration changes.
When you click Save, the Copy/Save Configuration page appears. Save the
Running Configuration file by copying it to the Startup Configuration file. After this
save, the red X icon and the Save application link are no longer displayed.
To logout, click Logout in the top right corner of any page. The system logs out of
the device.
When a timeout occurs or you intentionally log out of the system, a message is
displayed and the Login page appears, with a message indicating the logged-out
state. After you log in, the application returns to the initial page.

Getting Started
Out-Of-Band Port
1
Cisco 350XG & 550XG Series 10G Stackable Managed Switches 14
The initial page displayed depends on the “Do not show this page on startup”
option in the Getting Started page. If you did not select this option, the initial page
is the Getting Started page. If you did select this option, the initial page is the
System Summary page.
Out-Of-Band Port
The switch supports an Out-of-Band (OOB) port. This port is used for the
management network. The out-of-band and the in-band ports share the same IP
routing table, therefore you cannot use the same subnet on both in-band and out-
of-band interfaces.
The IP address assigned to this port cannot be assigned to the in-band ports at
the same time. In addition, the IP address assigned to the OOB port must not
belong to any IP subnet configured at the in-band interfaces of the devices.
By default, the OOB port is configured with the default IP address 192.168.1.254.
This default IP address is used when no other address was assigned (dynamically
or statically). This sub net is a reserved one and cannot be assigned on the in-
band interfaces.

Getting Started
Basic or Advanced Display Mode
Cisco 350XG & 550XG Series 10G Stackable Managed Switches 15
1
Basic or Advanced Display Mode
The device supports the following display modes:
•Basic—Basic subset of configuration options are available. If you are
missing some configuration option, select the Advanced mode in the device
header.
•Advanced—Full set of configuration options are available.
Quick Start Device Configuration
For quick initial setup, you can use the configuration wizards described in VLAN
Configuration Wizard or use the links on the Getting Started page, as described
below:.
Category Link Name (on the Page) Linked Page
Initial Setup Manage Stack Stack Management
Change Management
Applications and Services
TCP/UDP Services
Change Device IP Address IPv4 Interface
Create VLAN VLAN Settings
Configure Port Settings Port Settings
Device Status System Summary System Summary
Port Statistics Interfaces
RMON Statistics Statistics
View Log RAM Memory
Quick Access Change Device Password User Accounts
Upgrade Device Software Firmware Operations
Backup Device Configuration File Operations
Create MAC-Based ACL MAC-Based ACLs Creation
Create IP-Based ACL IPv4-based ACL Creation

Getting Started
Interface Naming Conventions
1
Cisco 350XG & 550XG Series 10G Stackable Managed Switches 16
There are two hot links on the Getting Started page that take you to Cisco web
pages for more information. Clicking on the Support link takes you to the device
product support page, and clicking on the Forums link takes you to the Support
Community page.
Interface Naming Conventions
Within the GUI, interfaces are denoted by concatenating the following elements:
•Type of interface: The following types of interfaces are found on the
various types of devices:
-Ten Gigabit Ethernet ports (1000/10,000 Mbps)—These are
displayed as XG.
-Out-of-Band Port—This is displayed as OOB.
-LAG (Port Channel)—These are displayed as LAG.
-VLAN—These are displayed as VLAN.
-Tunnel —These are displayed as Tunnel.
•Unit Number—Number of the unit in the stack.
•Slot Number—The slot number is always 0.
•Interface Number: Port, LAG, tunnel, or VLAN ID.
Configure QoS QoS Properties
Configure Port Mirroring Port and VLAN Mirroring
Category Link Name (on the Page) Linked Page

Getting Started
Window Navigation
Cisco 350XG & 550XG Series 10G Stackable Managed Switches 17
1
Window Navigation
This section describes the features of the web-based switch configuration utility.
Application Header
The Application Header appears on every page. It provides the following
application links:
Application Link
Name
Description
A flashing red X icon displayed to the left of the Save
application link indicates that Running Configuration
changes have been made that have not yet been saved to
the Startup Configuration file. The flashing of the red X can
be disabled on the Copy/Save Configuration page.
Click Save to display the Copy/Save Configuration page.
Save the Running Configuration file by copying it to the
Startup Configuration file type on the device. After this
save, the red X icon and the Save application link are no
longer displayed. When the device is rebooted, it copies
the Startup Configuration file type to the Running
Configuration and sets the device parameters according
to the data in the Running Configuration.
Username Displays the name of the user logged on to the device. The
default username is cisco. (The default password is cisco).

Getting Started
Window Navigation
1
Cisco 350XG & 550XG Series 10G Stackable Managed Switches 18
Language Menu This menu provides the following options:
•Select a language: Select one of the languages that
appear in the menu. This language will be the web-
based configuration utility language.
•Download Language: Add a new language to the
device.
•Delete Language: Deletes the second language on
the device. The first language (English) cannot be
deleted.
•Debug: Used for translation purposes. If you select
this option, all web-based configuration utility labels
disappear and in their place are the IDs of the
strings that correspond to the IDs in the language
file.
NOTE To upgrade a language file, use the Upgrade/
Backup Firmware/Language page.
Logout Click to log out of the web-based switch configuration
utility.
About Click to display the device name and device version
number.
Help Click to display the online help.
The SYSLOG Alert Status icon appears when a SYSLOG
message, above the critical severity level, is logged. Click
the icon to open the RAM Memory page. After you access
this page, the SYSLOG Alert Status icon is no longer
displayed. To display the page when there is not an active
SYSLOG message, Click Status and Statistics > View
Log > RAM Memory.
Application Link
Name
Description

Getting Started
Window Navigation
Cisco 350XG & 550XG Series 10G Stackable Managed Switches 19
1
Management Buttons
The following table describes the commonly-used buttons that appear on various
pages in the system.
Button Name Description
Use the pull-down menu to configure the number of
entries per page.
Indicates a mandatory field.
Add Click to display the related Add page and add an entry to a
table. Enter the information and click Apply to save it to the
Running Configuration. Click Close to return to the main
page. Click Save to display the Copy/Save Configuration
page and save the Running Configuration to the Startup
Configuration file type on the device.
Apply Click to apply changes to the Running Configuration on the
device. If the device is rebooted, the Running
Configuration is lost, unless it is saved to the Startup
Configuration file type or another file type. Click Save to
display the Copy/Save Configuration page and save the
Running Configuration to the Startup Configuration file
type on the device.
Cancel Click to reset changes made on the page.
Clear Filter Click to clear filter to select information displayed.
Clear All
Interfaces
Counters
Click to clear the statistic counters for all interfaces.
Clear Interface
Counters
Click to clear the statistic counters for the selected
interface.
Clear Logs Clears log files.
Clear Table Clears table entries.
Close Returns to main page. If any changes were not applied to
the Running Configuration, a message appears.